How to extract the fields for the Multiline- Each line has different Formats

[rajeswariramar]

I'm having problem with a multi-line field extraction which I have been struggling to figure out.

Below the log files ..

2018-01-02T13:24:30,503|[http-nio-8181-exec-4]|INFO|VM1|DocumentUploadRestController|DE0F4345165F89085E86221B49F86C02|5fac4fca-3dda-4f56-ac9d-f46889badcc9|TESTC01|Normal|A01|11071|1658049|147213323|null|SUCCESS|ImageByte

2018-01-02T13:28:19,420|[http-nio-8181-exec-7]|INFO|VM2|RestController|9E6D1D1CCEB59143C66A3A3FBC050692|5c191357-c436-4577-8896-ab983997cb65|1323574285.736696.48319626.2018167121.17362971%40-1983397168.17368709|TEST02|Normal|A02|2265|14388|147213326|null|SUCCESS|Multipart

2018-01-02T13:08:06,661|[http-nio-8181-exec-8]|INFO|VM3|DocumentUploadRestController|59BC5ADE721BF054A874FF6EF735E71D|46ca1a17-f35f-4193-9192-cc6c8d66d219|-603590707.736696.46257691.1596685263.27318499|TEST03|Normal|A03|18|264360|null|null|Invalid error message Number|Multipart

i m trying to extract the Fields Date, VM, and from user id (TEST01,TEST02) all the fields. for the first line is not matching with other 2 lines.. so i m trying to get the details sing below query but i m not getting Proper Result.

^(?P[^|]+)[^]\n]]|\w+|(?P\w+)(?:[^|\n]|){5}(?P[^|]+)

for the first line instead of user id TESTC01 its extracting next vale as "Normal".

Can yo please help me to extract the fields for the uneven lines log files

[mayurr98 · Accepted solution]

hey try this!!

| rex field=_raw "^(?P<date>[^\|]+)\|\[.*\]\|\w+\|(?P<VM>\w+)((.*\.\d+\|)|(.*\-\w+\|))(?P<user_id>[^\|]+)"

let me know if this helps you!

[rajeswariramar]

thank you so much .. the above is working fine

[p_gurav]

Hi rajeswariramar,

Try to use auto-field-extractor with delimiter "|" instead of regex.

[mayurr98]

can you put your regex in 101010 sample code? as it is not properly showing

[rajeswariramar]

^(?P<TimeFrame>[^|]+)[^]\n]]|\w+|(?P<*VM>\w+)(?:[^|\n]|){5}(?P<*userid>[^|]+)